CODEWITHSUNDEEP
oauth-2.0apigee
pvpkiran
pvpkiran

Reputation: 27048

apigee oauth2 generates new access token everytime

I am trying my hands on apigee. I have configured a proxy with oauth2.0 security.

Everything works fine. But I noticed that a new access token is generated everytime I hit the oauth2/accesstoken endpoint, eventhough the previous one has not expired.

So as a consequence my endpoint is accessible with more than one token at a time. I am not an oauth2 expert, but isn't this a security risk? If we have so many accesstokens floating around. Please clarify.
Is this the usual implementation of every oauth2 server or is it specific to apigee and if so why?

My assumption is that for a particular client key/secret there would be only one valid access token at any given time and when this expires, the client should request for a new token using refresh token. Is this wrong?

Upvotes: 0

Views: 456

Answers (2)

deadzg_devil
deadzg_devil

Reputation: 378

Use ResponseCache policy for lookup/populate cache. It's a read through cache policy.

Upvotes: 1

Pim H
Pim H

Reputation: 223

Use PopulateCache and LookupCache Policy.

Upvotes: 0

Related Questions